One-Class SVM (OCSVM) is a variant of Support Vector Machine designed for anomaly detection in an unsupervised setting. Unlike traditional supervised SVMs that require both positive and negative examples, OCSVM learns a decision boundary using only data from a single class (typically the normal class). Its primary goal is to identify novel or anomalous data points that deviate significantly from the patterns observed in the training data. OCSVM is particularly effective for high-dimensional and sparse anomaly detection problems.

Strictly speaking, OCSVM is categorized as a novelty detection method rather than an outlier detection method. In novelty detection, the training set is assumed to be free of anomalies; the model learns the boundary of the normal data and flags new samples that fall outside this boundary as novel. In contrast, outlier detection methods can handle training data that may contain outliers. However, due to its robustness in high-dimensional spaces and under minimal distributional assumptions, OCSVM is also commonly applied to outlier detection tasks.

Core Principle: Enclosing Normal Data

The fundamental idea behind OCSVM is to find a hyperplane (or, in the kernelized version, a hypersphere) that separates the normal data points from the origin in the feature space. This hyperplane is chosen to maximize the margin between the origin and the normal data, effectively enclosing the normal points. Alternatively, the Support Vector Data Description (SVDD) approach learns a minimal-volume hypersphere that contains most of the training data. Both approaches aim to create a compact boundary around the normal class.

Decision Function: For a new data point, the model computes its signed distance to the decision hyperplane. A positive distance indicates the point lies inside the normal region, while a negative distance suggests it is anomalous. The points that lie closest to the boundary are called support vectors and define the location and oreintation of the decision boundary.

Algorithmic Steps

1. Kernel Trick: OCSVM employs kernel functions (e.g., RBF, linear, polynomial) to project the input data into a higher-dimensional feature space. This enables the discovery of non-linear separation boundaries in the original space. The choice of kernel and its parameters (e.g., gamma for RBF) is critical to model performance.

2. Objective Function: OCSVM solves an optimization problem that balances two objectives:

   • Minimize the distance from the origin to the hyperplane (or the volume of the hypersphere)
   • Maximize the separation margin between the hyperplane and the normal data points The trade-off is controlled by the parameter nu, which sets an upper bound on the fraction of training errors and a lower bound on the fraction of support vectors. Typically, nu is chosen between 0.1 and 0.5.

3. Anomaly Detection: For each test sample, the decision function computes its signed distance. Samples with a positive decision value are classified as normal (class +1), while those with a negative value are classified as anomalous (class -1).

Practical Applications

• Network Security: Detecting intrusion attempts by identifying traffic patterns that deviate from normal network behavior.
• Financial Fraud: Flagging fraudulent credit card transactions, unusual trading activities, or money laundering patterns.
• Industrial Monitoring: Predicting equipment failures by detecting anomalous sensor readings in manufacturing processes.
• Medical Diagnostics: Identifying tumors, lesions, or abnormal tissue in medical imaging.

Implementation with Scikit-learn

The sklearn.svm.OneClassSVM class provides a Python implementation. Key parameters include:

• kernel: kernel type (default 'rbf')
• nu: controls the sensitivity to anomalies (default 0.1)
• gamma: kernel coefficient for RBF, polynomial, and sigmoid kernels

API Methods

• fit(X): learns the decision boundary from unlabeled training data.
• predict(X): returns +1 for normal samples, -1 for anomalies.
• decision_function(X): returns signed distances; positive values indicate normal points.
• score_samples(X): returns the opposite of the decision function (larger values indicate normality).

Example: Synthetic Data

import numpy as np
import matplotlib.pyplot as plt
from sklearn import svm

rng = np.random.RandomState(42)
# Generate normal training data
X_normal = 0.3 * rng.randn(200, 2)
X_train = np.r_[X_normal + 2, X_normal - 2]
# Generate test data (mixture of normal and anomalous)
X_test = np.r_[rng.uniform(low=-6, high=6, size=(50, 2))]

# Train One-Class SVM
model = svm.OneClassSVM(nu=0.1, kernel="rbf", gamma=0.1)
model.fit(X_train)

# Predict
preds_train = model.predict(X_train)
preds_test = model.predict(X_test)

# Visualization
plt.figure(figsize=(8, 6))
plt.scatter(X_train[:, 0], X_train[:, 1], c='black', label='Training samples')
plt.scatter(X_test[:, 0], X_test[:, 1], c='red', label='Test samples')

# Plot decision boundary
x_min, x_max = X_test[:, 0].min() - 1, X_test[:, 0].max() + 1
y_min, y_max = X_test[:, 1].min() - 1, X_test[:, 1].max() + 1
xx, yy = np.meshgrid(np.linspace(x_min, x_max, 500), np.linspace(y_min, y_max, 500))
Z = model.decision_function(np.c_[xx.ravel(), yy.ravel()])
Z = Z.reshape(xx.shape)
plt.contour(xx, yy, Z, levels=[0], linewidths=2, colors='blue')

plt.title("One-Class SVM Decision Boundary")
plt.legend()
plt.show()

In this example, the model learns a circular boundary around the normal training points. Test points inside the boundary (positive decision value) are classified as normal, while those outside (negative decision value) are flagged as anomalies.

Strengths and Limitations

Advantages

• Requires only normal data for training, making it suitable for scenarios where anomalous samples are rare or costly to obtain.
• Adapts well to high-dimensional and complex data distributions.
• Provides control over anomaly sensitivity via the nu parameter.

Disadvantages

• High computational cost for large datasets, particularly with non-linear kernels.
• Performence degrades when the normal data is not clean (e.g., contains outliers or noise) or has a highly uneven distribution.
• Sensitive to hyperparameter choices (kernel, gamma, nu); improper tuning can lead to overfitting or underfitting.